OUR COMMITMENT TO INTEGRITY

Code of Ethical Business Conduct

© Prometheus Laboratories Inc. 2015

A Nestlé Health Science Company

for the person in every one of us

Business Conduct 1

Our Principles

:: Prometheus Laboratories Inc. (“Prometheus” or the “Company”) is a proud, wholly-owned subsidiary of Nestlé Health Science, a health-science company engaged in advancing the role of nutritional therapy to change the course of health for consumers, patients and our partners in healthcare. It is our privilege to share our Code of Ethical Business Conduct (the “Code”) with you, highlighted by the core principles below which are central to our corporate culture.

:: Principles That Inspire Us ::

• Be Bold

• Be Collaborative

• Be Simple & Focused

2

1 • • • • • • • • • • Our Principles

6 • • • • • • • • • • Our Fundamental Commitments

9 • • • • • • • • • • Our Workplace :: Employee Handbook:: Safety and the Environment

12 • • • • • • • • Our Commitment to Patients:: Patient Safety:: Clinical Research Standards

13 • • • • • • • • Privacy, Security and Confidentiality:: Privacy and Security of Patient Information:: Confidential and Proprietary Business Information:: Disclosures of Company Information

14 • • • • • • • • Ethics and Integrity in Interactions with Health Care Professionals:: Interactions with Health Care Professionals :: Marketing Our Products and Services

15 • • • • • • • • Business Ethics and Integrity:: Research Integrity:: Antitrust:: Fair Dealing and the Federal Trade Commission Act:: Insider Trading:: Maintenance of Corporate Books, Records, Documents and Accounts:: Financial Reports :: Record Retention/Destruction:: Ineligible Persons:: Federal and State Anti-kickback Statutes:: The Stark Law:: Civil Monetary Penalties Law:: False Claims Acts:: State and Federal Reporting Requirements :: Licensing and Accreditations

Table of Contents

2

1 • • • • • • • • • • Our Principles

6 • • • • • • • • • • Our Fundamental Commitments

9 • • • • • • • • • • Our Workplace :: Employee Handbook:: Safety and the Environment

12 • • • • • • • • Our Commitment to Patients:: Patient Safety:: Clinical Research Standards

13 • • • • • • • • Privacy, Security and Confidentiality:: Privacy and Security of Patient Information:: Confidential and Proprietary Business Information:: Disclosures of Company Information

14 • • • • • • • • Ethics and Integrity in Interactions with Health Care Professionals:: Interactions with Health Care Professionals :: Marketing Our Products and Services

15 • • • • • • • • Business Ethics and Integrity:: Research Integrity:: Antitrust:: Fair Dealing and the Federal Trade Commission Act:: Insider Trading:: Maintenance of Corporate Books, Records, Documents and Accounts:: Financial Reports :: Record Retention/Destruction:: Ineligible Persons:: Federal and State Anti-kickback Statutes:: The Stark Law:: Civil Monetary Penalties Law:: False Claims Acts:: State and Federal Reporting Requirements :: Licensing and Accreditations

Table of Contents

Business Conduct

“Integrity has no need for rules.”– ALBERT CAMUS

3

21 • • • • • • • • Conflicts of Interest:: Gifts:: Protection and Proper Use of Company Assets:: Bribery, Kickback and Fraud:: Corporate Opportunities

24 • • • • • • • • Compliance Reporting and Our Shared Responsibilities:: Complying with Our Policies and Procedures:: Management Responsibility:: Reporting Compliance Concerns or Violations:: The Ethics HelpLine 1-888-PRO-RXDX:: Non-retaliation Policy:: Investigation and Resolution:: Disciplinary Action

26 • • • • • • • • Resource Guide:: Managers:: Legal Affairs/Compliance Group:: Human Resources

27 • • • • • • • • Compliance with the Code of Ethical Business Conduct

We are accountable for our decisions

in our personal life so why shouldn’t we

be just as accountable in our work life?– Catherine Pulsifer

6

:: TO OUR PATIENTS ::We are committed to improving the lives of patients by providing healthcare professionals with a comprehensive approach to the diagnosis and treatment for acute and chronic diseases. Our commitment to personalized medicine helps physicians to make better decisions for “the person in every patient®.”

:: TO OUR FELLOW PROMETHEUS EMPLOYEES ::We are committed to a culture that treats all employees (as well as contingent staff and consultants) with fairness, dignity, and respect, and affords them an opportunity to grow, develop professionally, and work in a team environment in which all ideas are considered.

:: TO OUR HEALTH CARE PROFESSIONALS ::We are committed to integrity in all our marketing and promotional activities. We provide valuable and accurate information to health care professionals and organizations in accordance with the relevant provisions of this Code, as well as all applicable laws, rules and regulations that govern our marketing activities.

:: TO OUR THIRD-PARTY PAYERS ::We are committed to dealing with our third-party payers in a way that demonstrates our commitment to contractual obligations and reflects our shared concern for quality, cost-effective health care. We encourage each of our third-party payers to adopt their own set of ethical principles to explicitly recognize their obligations to patients as well as the need for fairness in dealing with providers.

:: TO OUR REGULATORS ::We are committed to an environment in which compliance with laws, regulations, and sound business practices is woven into our corporate culture. We accept the responsibility to aggressively self-govern and monitor compliance with the requirements of state and federal laws, industry guidance, and our Code of Ethical Business Conduct. We are committed to complying with the PhRMA Code on Interactions with Health Care Professionals, as well as applicable state and federal regulations (e.g. federal Sunshine provisions and State Marketing laws, such as the Massachusetts Marketing Code of Conduct for sales and marketing activities related to licensed health care practitioners in Massachusetts).

:: TO THE COMMUNITY WE SERVE ::We are committed to understanding the particular needs of the communities we serve and our responsibility to promote health and provide assistance to those in need. We proudly invest the scope of our resources – people, skills, expertise and funding – to increase access to medicines and diagnostic tests, to promote good will and further charitable causes.

Our Fundamental Commitments

6

:: TO OUR PATIENTS ::We are committed to improving the lives of patients by providing healthcare professionals with a comprehensive approach to the diagnosis and treatment for acute and chronic diseases. Our commitment to personalized medicine helps physicians to make better decisions for “the person in every patient®.”

:: TO OUR FELLOW PROMETHEUS EMPLOYEES ::We are committed to a culture that treats all employees (as well as contingent staff and consultants) with fairness, dignity, and respect, and affords them an opportunity to grow, develop professionally, and work in a team environment in which all ideas are considered.

:: TO OUR HEALTH CARE PROFESSIONALS ::We are committed to integrity in all our marketing and promotional activities. We provide valuable and accurate information to health care professionals and organizations in accordance with the relevant provisions of this Code, as well as all applicable laws, rules and regulations that govern our marketing activities.

:: TO OUR THIRD-PARTY PAYERS ::We are committed to dealing with our third-party payers in a way that demonstrates our commitment to contractual obligations and reflects our shared concern for quality, cost-effective health care. We encourage each of our third-party payers to adopt their own set of ethical principles to explicitly recognize their obligations to patients as well as the need for fairness in dealing with providers.

:: TO OUR REGULATORS ::We are committed to an environment in which compliance with laws, regulations, and sound business practices is woven into our corporate culture. We accept the responsibility to aggressively self-govern and monitor compliance with the requirements of state and federal laws, industry guidance, and our Code of Ethical Business Conduct. We are committed to complying with the PhRMA Code on Interactions with Health Care Professionals, as well as applicable state and federal regulations (e.g. federal Sunshine provisions and State Marketing laws, such as the Massachusetts Marketing Code of Conduct for sales and marketing activities related to licensed health care practitioners in Massachusetts).

:: TO THE COMMUNITY WE SERVE ::We are committed to understanding the particular needs of the communities we serve and our responsibility to promote health and provide assistance to those in need. We proudly invest the scope of our resources – people, skills, expertise and funding – to increase access to medicines and diagnostic tests, to promote good will and further charitable causes.

Our Fundamental Commitments

Business Conduct 7

Our Commitments are R

:: GUIDING PRINCIPLES :: Guiding principles are values that are important to us personally and professionally.

we choose to work with because they form the basis of interaction in virtually everything that we do.

:: OUR GOALS :: We understand that Prometheus’ continuous goal is to create a working environment in which every employee demonstrates our values every day. Ethical Business Conduct contains commitments and values that help further that goal and also r ow we can demonstrate these values in our relationships with patients, coworkers, the organization, the government, business partners, contractors, competitors and the community.

:: OUR RESPONSIBILITIES :: Every employee (as w responsibility to read the Code of Ethical Business Conduct and live by its values. We are responsible for upholding the Prometheus values in our everyday work — speaking up when we have a question or concern and reporting conduct that is inconsistent with those values. Along with the Code, Prometheus policies provide additional guidance. We have a responsibility to be aware of and follow the policies related to our job. For

y, contact your manager, the Human Resources Depar Department/Compliance Group.

“Real integrity is

doing the right thing,

knowing that nobody

is going to know

whether you did

it or not.”

– UNKNOWN

8

Our Principles Our Culture

:: PRINCIPLES ::Prometheus senior leadership agrees that the follo principles and

ensuing culture of Prometheus:

O rounded in:• Being bold• Being collaborative• Being simple and focused

rt the following:• We value a focus on bold moves (testing, learning and taking calculated risks)• We value challenging status quo and changing the way people view nutritional

therapies in health managment• We value a can do attitude and passion• We value working constructively with everyone who contributes• We value being open to fresh ideas and leverage diversity of backgrounds

and experiences• We value acting with integrity and together committing to succeed• We value a focus on what matters–making choices• We value delivering against clear, actionable and measurable priorities• We value being accountable in delivering consumer value with a lean and

nimble mindset

“Real integrity is

doing the right thing,

knowing that nobody

is going to know

whether you did

it or not.”

– UNKNOWN

8

Our Principles Our Culture

:: PRINCIPLES ::Prometheus senior leadership agrees that the follo principles and

ensuing culture of Prometheus:

O rounded in:• Being bold• Being collaborative• Being simple and focused

rt the following:• We value a focus on bold moves (testing, learning and taking calculated risks)• We value challenging status quo and changing the way people view nutritional

therapies in health managment• We value a can do attitude and passion• We value working constructively with everyone who contributes• We value being open to fresh ideas and leverage diversity of backgrounds

and experiences• We value acting with integrity and together committing to succeed• We value a focus on what matters–making choices• We value delivering against clear, actionable and measurable priorities• We value being accountable in delivering consumer value with a lean and

nimble mindset

“There is a big difference

between what you have

the right to do and what

is right to do.”

– JUSTICE POTTER STEWART

Business Conduct9

:: EMPLOYEE HANDBOOK ::We have a positive and safe working environment that promotes respect and diversity. We do not tolerate conduct that disrupts our work environment including behavior that is disrespectful, hostile, violent, intimidating, threatening or harassing. Sexual or other unlawful harassment or discrimination includes any verbal, physical or visual conduct based on sex, race, age, national origin, disability or any other legally protected basis. We are expected to follow all policies regarding employee conduct that are contained in our Employee Handbook.

:: SAFETY AND THE ENVIRONMENT ::We carefully consider the health and safety of our employees and customers. Each of us is responsible for maintaining a safe workplace and complying with all applicable laws, regulations, and Prometheus policies. We strive to conduct our business in an environmentally sustainable manner and maintain systems, programs and procedures for the environmentally responsible management of our business.

Our Workplace

Have the courage to say no.

Have the courage to face the truth.

Do the right thing because it is right.

These are the keys to living your life

with integrity. – W. Clement Stone

“Bettering the

human condition is

the greatest good

any individual can

achieve.”

– DR. THOMAS F. FIRST, SR.

12

Prometheus is committed to improving lives through the development and commercialization of novel pharmaceutical and diagnostic products that enable physicians to provide greater individualized patient care. Our strategy includes the marketing and promotion of pharmaceutical products and complementary proprietary diagnostic testing services. By integrating pharamaceutical and nutritional therapeutics with diagnostics, we believe we can provide physicians with more targeted solutions to optimize care for their patients.

:: PATIENT SAFETY ::We work hard to develop laboratory protocols for our diagnostic tests and follow proper procedures and have appropriate oversight over our diagnostic tests to help ensure accuracy of results. For our pharmaceutical products, we continue to monitor all of our medicines for side e�ects. We notify the appropriate authorities about side e�ects of which we become aware and cooperate with them in taking any necessary action.

:: CLINICAL RESEARCH STANDARDS ::We follow all relevant laws and regulations governing research and development. �ese include ensuring that: those taking par t in clinical research are not exposed to unnecessary risks; participants understand the nature and purpose of the research; participation is voluntary and does not a�ect the ability to receive future treatment; proper procedures for gaining informed consent are followed; and appropriate con�dentiality rules are applied.

Our Commitment to Patients

Point of OpportunityPrivacy In Action

The Situation: An employee in Client Services learns that a test report was inadvertently sent to the wrong physician office due to having an outdated fax number. The employee recognizes that this inadvertent disclosure of protected health information (PHI) was a privacy breach, but is unsure what steps to take.

The Solution: The employee should (1) initiate a Customer Complaint; (2) contact the unintended recipient and ask them to shred and destroy the test report, as it contains confidential PHI; (3) obtain the correct fax number to prevent any reoccurrence; (4) update the system to reflect corrected fax number; and (5) retransmit the report to the correct ordering physician.

Business Conduct 13

We have been entrusted with valuable and private information about our patients and our Company. We take our responsibility to protect that information seriously. In addition, federal and state governments have passed laws to ensure the protection of confidential patient information.

:: PRIVACY AND SECURITY OF PATIENT INFORMATION ::Written, verbal and electronic health information is protected by law from unlawful access, use, disclosure, alteration or destruction. Use and disclosure of a patient’s health information is limited to the “minimum amount necessary” to accomplish the intended purpose. Unless authorized by federal or state law, the disclosure of patient information requires a patient, or the patient’s representative, to sign a written Authorization for the Use or Disclosure of Protected Health Information (PHI) for purposes other than treatment, payment of that treatment or health care operations. The Health Insurance Portability and Accountability Act (“HIPAA”) Privacy Regulations require safeguards for appropriate access, use and disclosure of PHI to protect patient privacy. Additionally, HIPAA Security Regulations also require protection for the electronic security of medical information.

In addition, we must secure a written business associate agreement with all persons and organizations who will receive, use or gain access to protected health information on our behalf. Business associate agreements will do three things: (1) identify the protected health information to be disclosed and used; (2) ensure the appropriate use of that protected health information; and (3) impose security, inspection and reporting requirements on the business associate.

:: CONFIDENTIAL AND PROPRIETARY BUSINESS INFORMATION ::We have developed and own unique proprietary technology, which in many cases is protected by a substantial patent estate. We also partner with other companies whose business information is proprietary to them. Much of the information concerning our business and our partners are confidential and should not be disclosed to our employees except as necessary in the performance of their jobs or to anyone outside of the Company, including family and friends. Confidential information is one of our most important assets. We are responsible for guarding against unauthorized disclosure of Company confidential and proprietary information.

:: DISCLOSURES OF COMPANY INFORMATION ::Since it is essential that information disclosed about the Company be consistent, non-public information about Prometheus, including financial information, may not be revealed to outsiders without the express authorization of the Chief Executive Officer (“CEO”) or the Chief Financial Officer (“CFO”). All telephone calls from media, financial analysts, business press, etc. should be referred to the CEO, the CFO, the VP of Finance, an authorized Corporate Communications/Investor Relations employee or other employees as expressly authorized by the CEO. Only these individuals are authorized to respond to these inquiries.

Privacy, Security and Confidentiality

Point of OpportunityMeals In Action

The Situation: A physician asks a sales rep to conduct their next meeting “over lunch” at the deli down the street, and expects the rep to pick up the $10 tab.

The Solution: The rep may not pick up the tab. The PhRMA Code and CA law states that an informational presentation or discussion conducted by a field sales rep or immediate manager may only be accompanied occasionally by a meal if the presentation is held in the health care professional’s office or hospital setting.

14

In all of our interactions with health care professionals and the medical community, we are committed to following the highest ethical standards as well as enhancing patient care through the effective use and delivery of our products and services. We are also concerned that our interactions with health care professionals not be perceived as inappropriate by patients or the public at large. The Code is based on the principle that a health care professional’s care of patients should be based, and should be perceived as being based, solely on each patient’s medical needs and the health care professional’s medical knowledge and experience.

Promotional materials provided to health care professionals by Prometheus should: (a) be accurate and not misleading; (b) make claims about a product only when properly substantiated; (c) reflect the balance between risks and benefits; and (d) be consistent with all other Food and Drug Administration (FDA) or other relevant laws, rules or regulations governing such communications.

:: INTERACTIONS WITH HEALTH CARE PROFESSIONALS ::We only engage the services of health care professionals and organizations when they are legitimately needed, and we must not pay more than an appropriate market rate for the services rendered. We must not enter into business relationships or offer or provide gifts, entertainment, hospitality or anything else of value, to induce or reward favorable decisions about our products and services.

:: MARKETING OUR PRODUCTS AND SERVICES ::We use a variety of methods to market and communicate information about our products and services, ranging from contact through sales representatives to the internet. Whatever the method used, we communicate information accurately, effectively and in a proper manner. The information we provide to support the safe use of our products, whether through publications and promotional materials or in response to inquiries received must be supported by scientific evidence and approved through our established review and approval procedures. We must only promote products for their approved uses.

Ethics and Integrity in Interactions with Health Care Professionals

Point of OpportunityMeals In Action

The Situation: A physician asks a sales rep to conduct their next meeting “over lunch” at the deli down the street, and expects the rep to pick up the $10 tab.

The Solution: The rep may not pick up the tab. The PhRMA Code and CA law states that an informational presentation or discussion conducted by a field sales rep or immediate manager may only be accompanied occasionally by a meal if the presentation is held in the health care professional’s office or hospital setting.

14

In all of our interactions with health care professionals and the medical community, we are committed to following the highest ethical standards as well as enhancing patient care through the effective use and delivery of our products and services. We are also concerned that our interactions with health care professionals not be perceived as inappropriate by patients or the public at large. The Code is based on the principle that a health care professional’s care of patients should be based, and should be perceived as being based, solely on each patient’s medical needs and the health care professional’s medical knowledge and experience.

Promotional materials provided to health care professionals by Prometheus should: (a) be accurate and not misleading; (b) make claims about a product only when properly substantiated; (c) reflect the balance between risks and benefits; and (d) be consistent with all other Food and Drug Administration (FDA) or other relevant laws, rules or regulations governing such communications.

:: INTERACTIONS WITH HEALTH CARE PROFESSIONALS ::We only engage the services of health care professionals and organizations when they are legitimately needed, and we must not pay more than an appropriate market rate for the services rendered. We must not enter into business relationships or offer or provide gifts, entertainment, hospitality or anything else of value, to induce or reward favorable decisions about our products and services.

:: MARKETING OUR PRODUCTS AND SERVICES ::We use a variety of methods to market and communicate information about our products and services, ranging from contact through sales representatives to the internet. Whatever the method used, we communicate information accurately, effectively and in a proper manner. The information we provide to support the safe use of our products, whether through publications and promotional materials or in response to inquiries received must be supported by scientific evidence and approved through our established review and approval procedures. We must only promote products for their approved uses.

Ethics and Integrity in Interactions with Health Care Professionals

“Always do right—

this will satisfy some

and astonish the rest.”

– MARK TWAIN

Business Conduct 15

We conduct business with honesty, fairness and integrity demonstrated through truthfulness, the absence of deception or fraud, and respect for applicable laws. We expect employees to understand and comply with the legal and regulatory requirements related to their areas of responsibility.

:: ANTITRUST ::In our efforts to drive the success of our business, we must only seek competitive advantage through lawful means. Antitrust laws are designed to protect the competitive process, and to promote fair and open competition by prohibiting certain agreements among competitors and others. Such agreements may include, but are not limited to, price fixing, territorial or customer allocations, boycotts of customers or suppliers, limits on output, and tying agreements. Prometheus fully supports the goals of protecting free markets and giving everyone the opportunity to succeed on the basis of superior products, and expects strict adherence to the letter and spirit of antitrust, competition or similar state and federal laws. When in doubt, contact the Legal Affairs Department/ Compliance Group.

:: FAIR DEALING AND THE FEDERAL TRADE COMMISSION ACT ::We are expected to deal fairly with our customers, suppliers, employees and anyone else with whom we have contact in the course of performing our jobs. The Federal Trade Commission Act provides that “unfair methods of competition in commerce, and unfair or deceptive acts or practices in commerce, are declared unlawful.” It is a violation of the Act to engage in deceptive, unfair or unethical practices, and to make misrepresentations in connection with sales activities.

:: INSIDER TRADING ::Public company employees who have access to confidential (or “inside”) information are not permitted to use or share that information for stock trading purposes or for any other purpose except to conduct our business. All non-public information about Prometheus or about companies with whom we do business is considered confidential.

:: MAINTENANCE OF CORPORATE BOOKS, RECORDS, DOCUMENTS AND ACCOUNTS ::The integrity of our records and public disclosures depends upon the validity, accuracy and completeness of the information supporting the entries to our books of account. Therefore, our corporate and business records should be completed accurately and honestly. We should never make false or misleading entries, whether they relate to financial results or test results.

Business Ethics and Integrity

:: RESEARCH INTEGRITY ::We observe and promote the principles of integrity in scientific and scholarly research. All Prometheus therapeutic and diagnostic research activities comply with all legal and regulatory requirements and we report the results and interpretations of our research in a transparent, accurate, fair and balanced manner.

Your reputation and integrity

are everything. Follow through on

what you say you are going to do.

Your credibility can only be built over

time, and it is built from the history

of your words and actions.– Maria Razumich-Zec

18

:: FINANCIAL REPORTS ::Our financial records are the basis for managing our business and fulfilling our obligations to various stakeholders. Therefore, any financial record must be accurate and in line with appropriate accounting standards. These reports are intended to provide a full, fair, accurate, timely and understandable disclosure and fairly represent our financial condition. Employees who collect, provide or analyze information for or otherwise contribute in any way in preparing or verifying these reports should strive to ensure that our financial disclosure is accurate and transparent. In addition, employees should strive to ensure that our reports contain all of the information about Prometheus that would be important to enable stakeholders to assess the soundness and risks of our business and finances and the quality and integrity of our accounting and disclosures.

:: RECORD RETENTION/DESTRUCTION ::All records (such as medical, financial and employee) will be stored in a safe and secure location for the period of time required by law. We will organize records in a manner that permits prompt retrieval. Old or unnecessary records will be properly disposed of in accordance with appropriate retention schedules and Prometheus document destruction/recycling policies. Shredding/recycle bins are located throughout the building for convenience. We should never destroy or alter any document in anticipation of, or in response to, a request for those documents by any government agency or court.

:: INELIGIBLE PERSONS ::We will not knowingly employ or bill for services ordered by an individual or entity that is excluded or ineligible to participate in federal health care programs, suspended or debarred from federal government contracts, or has been convicted of a criminal offense relative to the provision of health care items or services and has not been reinstated in a federal health care program. We are each individually accountable to notify our manager, the Human Resources Department or the Legal Department/Compliance Group if we become excluded, debarred, or ineligible to participate in a federal health care program, or have been convicted of a criminal offense related to the provision of health care products or services.

“It takes less time to

do a thing right than

it does to explain why

you did it wrong.”

– HENRY WADSWORTH

LONGFELLOW

18

:: FINANCIAL REPORTS ::Our financial records are the basis for managing our business and fulfilling our obligations to various stakeholders. Therefore, any financial record must be accurate and in line with appropriate accounting standards. These reports are intended to provide a full, fair, accurate, timely and understandable disclosure and fairly represent our financial condition. Employees who collect, provide or analyze information for or otherwise contribute in any way in preparing or verifying these reports should strive to ensure that our financial disclosure is accurate and transparent. In addition, employees should strive to ensure that our reports contain all of the information about Prometheus that would be important to enable stakeholders to assess the soundness and risks of our business and finances and the quality and integrity of our accounting and disclosures.

:: RECORD RETENTION/DESTRUCTION ::All records (such as medical, financial and employee) will be stored in a safe and secure location for the period of time required by law. We will organize records in a manner that permits prompt retrieval. Old or unnecessary records will be properly disposed of in accordance with appropriate retention schedules and Prometheus document destruction/recycling policies. Shredding/recycle bins are located throughout the building for convenience. We should never destroy or alter any document in anticipation of, or in response to, a request for those documents by any government agency or court.

:: INELIGIBLE PERSONS ::We will not knowingly employ or bill for services ordered by an individual or entity that is excluded or ineligible to participate in federal health care programs, suspended or debarred from federal government contracts, or has been convicted of a criminal offense relative to the provision of health care items or services and has not been reinstated in a federal health care program. We are each individually accountable to notify our manager, the Human Resources Department or the Legal Department/Compliance Group if we become excluded, debarred, or ineligible to participate in a federal health care program, or have been convicted of a criminal offense related to the provision of health care products or services.

“It takes less time to

do a thing right than

it does to explain why

you did it wrong.”

– HENRY WADSWORTH

LONGFELLOW

Point of OpportunityStark In Action

The Situation: In February and again in September, a sales rep provides lunch (valued at $10 each) for a physician as part of a sales call. In July, the same physician also receives a meal (valued at $50) during a speaker program. A member of Medical Affairs has also provided a meal to the same physician (valued at $50) as part of a consulting engagement. The sales rep is planning a sales call over lunch, how much applies toward the annual Stark allowance?

The Solution: Tracking the allowance under the Stark regulation applies to physicians. In this case, take the $20 for the two lunches, and add it to the $50 for the speaker program meal, and $50 for the consulting meal, and it totals $120 toward the Stark allowance. If you are unsure, the Stark allowance can be checked in ClikView. Note that reporting spend under state law or the federal Sunshine Act may be different.

Business Conduct 19

:: FEDERAL AND STATE ANTI-KICKBACK STATUTES ::Federal and state Anti-Kickback statutes are violated when remuneration is given, offered, accepted or solicited in exchange for referral of patients who are covered under federal health care programs, unless a statutory exception or safe harbor applies. Harsh criminal, civil and monetary penalties can be a consequence. A kickback is considered any item of value, or compensation of any kind, such as money, commissions, credits, gifts, gratuities, discounts, etc. that are provided, directly or indirectly, to improperly obtain or reward favorable treatment. Payments or items of value offered to influence referrals are considered inducements and are prohibited. The Office of Inspector General (“OIG”) created safe-harbors, or regulatory carve-outs that define specific conduct that will not be punishable under the statute, even though it would otherwise be prohibited conduct under the statute.

:: THE STARK LAW ::The Stark Law prohibits a physician who has a direct or indirect financial relationship with an entity from making referrals to that entity for the provision of designated health services (“DHS”) for which payment may otherwise be made under Medicare, unless the financial relationship satisfies an applicable statutory or regulatory exception. The Stark Law also prohibits the entity providing DHS from presenting any bill or claim for payment for a DHS furnished as a result of the prohibited referral. Clinical laboratory services are considered DHS. Accordingly, we must always be certain that an exception exists prior to entering into a financial relationship with a physician, who refers DHS to Prometheus. There are also state laws with similar requirements with regard to state programs.

:: CIVIL MONETARY PENALTIES LAW ::The Social Security Act authorizes the Office of Inspector General (“OIG”) to impose civil monetary penalties (CMPs) and assessments for many types of conduct. The OIG is authorized to seek different amounts of CMPs and assessments based on the type of violation at issue. For example, in a case of false or fraudulent claims, the OIG may seek a penalty of up to $10,000 for each item or service improperly claimed, and an assessment of up to three times the amount improperly claimed. In a kickback case, the OIG may seek a penalty of up to $50,000 for each improper act and damages of up to three times the amount of remuneration at issue (regardless of whether some of the remuneration was for a lawful purpose). Additionally, in most cases for which the OIG may seek CMPs, the OIG may also seek exclusion from participation in all Federal health care programs.

20

:: FALSE CLAIMS ACTS ::The Federal False Claims Act makes it a crime for any person or organization to knowingly make a false record or file a false claim with the government for payment. “Knowing” can include deliberate or reckless ignorance of facts that make the claim false. State False Claims Acts and other applicable statutes also provide criminal, civil and administrative penalties and sanctions for providers and individuals who participate with providers in making false statements, misrepresenting facts, concealing facts, and submitting claims for unnecessary services. These laws carry significant sanctions including fines, imprisonment, court costs, attorney’s fees and full restitution to the victim of the fraud.

:: STATE AND FEDERAL REPORTING REQUIREMENTS ::We must fulfill certain price reporting obligations in connection with state and federal health care programs. These price reporting obligations include reporting Medicaid drug rebate figures (the “Average Manufacturer Price” and “Best Price”) to the Centers for Medicare and Medicaid Services. In all such cases, we must calculate and report the relevant pricing information in accordance with the rules governing the particular program – starting from accurate net prices that are not distorted by any hidden discounts. All price concessions to purchasers must be identified as such and appropriately reflected in reported prices.

In addition, Prometheus complies with state law disclosure reporting requirements, which include gift-giving limitations, and in some cases gift bans. Fines and penalties for each violation of gift ban laws can be steep, and more states are considering similar laws. At the federal level, the Sunshine provision of the Patient Protection and Affordable Care Act (PPACA) requires the disclosure of a variety of monetary payments, such as honoraria, consulting fees, gifts and meals made to physicians and health care institutions by certain life science companies.

:: LICENSING AND ACCREDITATIONS ::In order to perform laboratory testing in the states where we operate, Prometheus must maintain the required state laboratory licenses and accreditations (such as CLIA and CAP). In addition, in order to distribute pharmaceutical products into the states where we operate, Prometheus must maintain the required state manufacturer or distribution licenses.

Business Conduct 21

When it comes to our work, we have a duty to put the interests of Prometheus before our own personal interests or gain. A conflicting personal interest could result from an expectation of personal gain now or in the future or from a need to satisfy a prior or current personal obligation. A conflict of interest includes anything that divides our loyalty between the best interests of Prometheus and those of another, such as a supplier, friend, relative, or competitor. All such conflicts, including the appearance of a conflict, should be avoided.

:: GIFTS ::Gifts, depending on who is involved, and the purpose, have the potential of creating a conflict of interest. Gifts cannot be offered, provided or accepted by any employee unless modest in value and not: (a) of more than token or nominal monetary value, (b) in cash, (c) at risk of being construed as a bribe or kickback, (d) made or received on a regular or frequent basis or (e) in violation of any laws.

In addition, the PhRMA Code and many states define gifts to include food and meals, and either establish limits for or prohibit gifts all together. State laws require reporting the cost of gifts/meals to certain licensed prescribers on an annual basis.

:: PROTECTION AND PROPER USE OF COMPANY ASSETS :: We are expected to protect our Company assets and ensure their efficient use. Theft, carelessness and waste have a direct impact on our profitability. We are expected to use Prometheus property only for legitimate business purposes. We may not use our corporate name, any brand name or trademark owned or associated with Prometheus or any letterhead stationery for any personal purpose.

:: BRIBERY, KICKBACK AND FRAUD ::No funds or assets of Prometheus shall be paid, loaned or otherwise disbursed as bribes, kickbacks or other payments designed to influence or compromise the objective conduct of the recipient. We also do not accept any funds or assets, including those provided as preferential treatment for fulfilling our responsibilities, for assisting in obtaining business or for securing special concessions for a company. We must not engage in any activity which degrades the reputation or integrity of Prometheus. Business should be conducted in such a manner that Prometheus’ reputation would not be damaged if the details of the dealings should become a matter of public discussion.

:: CORPORATE OPPORTUNITIES ::We may not take personal advantage of opportunities for Prometheus that are presented to us or discovered by us as a result of our position with Prometheus or through our use of corporate property or information. Even opportunities that are acquired privately by you may be questionable if they are related to our existing or proposed lines of business. Significant participation in an investment or outside business opportunity that is directly related to our lines of business must be pre-approved by the Legal Affairs Department/Compliance Group. We may not use our position with Prometheus or corporate property or information for improper personal gain, nor should we compete with Prometheus in any way.

Point of OpportunityEthics In Action

The Situation: An employee of Prometheus is asked to be a short-term, part-time consultant for a local hospital foundation. The engagement is not directly related to the employee’s role at Prometheus. The foundation is trying to raise money for their annual event, and calls on employee to request funds from Prometheus. After following the process to secure an appropriate $1,000 booth sponsorship, the foundation offers the employee a $100 gift card as a thank you.

The Solution: First, the Employee Handbook states that all potentially conflicting work outside of Prometheus must first be approved by the department VP. Further, the employee may not accept the thank you gift card, as it would be a conflict of interest to personally benefit from this arrangement.

Conflicts of Interest

The time is always right

to do what is right.– Martin Luther King, Jr.

24

:: COMPLYING WITH OUR POLICIES AND PROCEDURES ::The Code provides a framework for applying our values and integrity into action, and serves as a guide for ethical conduct. As Prometheus employees, we must take responsibility for safeguarding the integrity of our organization, and also the integrity of our own actions.

Our conduct is our own responsibility. We should never engage in dishonest or illegal behavior, even if directed to do so by a manager or coworker, nor should we direct others to act in such a manner. If requested to act in such a manner, we must report it immediately to the Compliance Officer.

:: MANAGEMENT RESPONSIBILITY ::Management has a responsibility to support the Code of Ethical Business Conduct, and will be measured in performance for:

• Educating all current and new employees under their supervision in the meaning and application of the Code;

• Emphasizing, by word and action, Prometheus’ continuing commitment to compliance: the prevention, detection and correction of inappropriate conduct;

• Supporting and assisting employees in complying with the Code; and• Ensuring strict compliance with Prometheus’ Non-Retaliation Policy.

:: REPORTING COMPLIANCE CONCERNS OR VIOLATIONS ::We all have an obligation to report any actual or suspected violation of the Code of Ethical Business Conduct. Reporting suspected violations is not an act of disloyalty. Rather, it shows responsibility.

To report compliance violations, you may do any of the following:• Contact your manager to discuss compliance issues;• Contact the Prometheus Compliance Officer or Legal Affairs Department/

Compliance Group;• If you prefer to remain anonymous, call the Prometheus Ethics HelpLine

at 1-888-PRO-RXDX; or• Submit a report to the Prometheus Ethics HelpLine online at

www.mycompliancereport.com/brand/rxdx. Reports will only go to the Compliance Officer, or designee, for appropriate action.

“Notice that ‘I’ is at the

center of the word

‘ethical.’ There is no

‘they.’ Achieving the

ethics of excellence

is our individual

assignment.”

– PRICE PRITCHETT

Compliance Reporting and Our Shared Responsibilities

24

:: COMPLYING WITH OUR POLICIES AND PROCEDURES ::The Code provides a framework for applying our values and integrity into action, and serves as a guide for ethical conduct. As Prometheus employees, we must take responsibility for safeguarding the integrity of our organization, and also the integrity of our own actions.

Our conduct is our own responsibility. We should never engage in dishonest or illegal behavior, even if directed to do so by a manager or coworker, nor should we direct others to act in such a manner. If requested to act in such a manner, we must report it immediately to the Compliance Officer.

:: MANAGEMENT RESPONSIBILITY ::Management has a responsibility to support the Code of Ethical Business Conduct, and will be measured in performance for:

• Educating all current and new employees under their supervision in the meaning and application of the Code;

• Emphasizing, by word and action, Prometheus’ continuing commitment to compliance: the prevention, detection and correction of inappropriate conduct;

• Supporting and assisting employees in complying with the Code; and• Ensuring strict compliance with Prometheus’ Non-Retaliation Policy.

:: REPORTING COMPLIANCE CONCERNS OR VIOLATIONS ::We all have an obligation to report any actual or suspected violation of the Code of Ethical Business Conduct. Reporting suspected violations is not an act of disloyalty. Rather, it shows responsibility.

To report compliance violations, you may do any of the following:• Contact your manager to discuss compliance issues;• Contact the Prometheus Compliance Officer or Legal Affairs Department/

Compliance Group;• If you prefer to remain anonymous, call the Prometheus Ethics HelpLine

at 1-888-PRO-RXDX; or• Submit a report to the Prometheus Ethics HelpLine online at

www.mycompliancereport.com/brand/rxdx. Reports will only go to the Compliance Officer, or designee, for appropriate action.

“Notice that ‘I’ is at the

center of the word

‘ethical.’ There is no

‘they.’ Achieving the

ethics of excellence

is our individual

assignment.”

– PRICE PRITCHETT

Compliance Reporting and Our Shared Responsibilities

Point of OpportunityReporting In Action

The Situation: An employee was reviewing a clinical trial protocol and had concerns about how the principle investigator was conducting herself. She raises the issue to her manager, but is told not to be concerned. She is uneasy with the response, but does not want to be perceived as though she were not a team player.

The Solution: The employee can (1) ask for an explanation from her manager, (2) report her concern to HR or Legal/Compliance Group, or (3) report her concern to the Ethics HelpLine. Employees have an obligation to speak up if they feel uncomfortable or feel we are in violation of the Code, policies or any laws/regulations. Prometheus has a strict non-retaliation policy for reporting issues or concerns.

Business Conduct 25

:: THE ETHICS HELPLINE 1-888-PRO-RXDX ::All calls to the Ethics HelpLine (1-888-PRO-RXDX) are received by trained personnel at a company contracted with, but independent of Prometheus, who document and forward all issues to the Compliance Officer, or designee for appropriate action. If you choose to identify yourself, your identity will be kept confidential to the extent permitted or required by law. All disclosures, interviews and reports shall also be kept confidential, to the extent permitted or required by law. Callers will always have the option to remain anonymous.

:: NON-RETALIATION POLICY ::Prometheus understands that an employee’s willingness to report potential compliance violations is reduced if the employee believes he/she will be subject to retaliation or retribution. Any employee who reports, in good faith, an alleged violation will not be subject to retaliation or retribution. Any employee engaging in retaliatory activity will be subject to discipline, up to and including termination.

:: INVESTIGATION AND RESOLUTION ::The Compliance Officer, or designee will impartially and thoroughly review, evaluate and respond to allegations of misconduct, concerns and/or inquiries made directly to the Legal Affairs Department/Compliance Group and/or the Ethics HelpLine. All calls will be followed up on and investigated in a timely manner.

:: DISCIPLINARY ACTION ::Adhering to the Code of Ethical Business Conduct, as well as all Prometheus policies, is a condition of employment and of doing business with Prometheus. Persons who violate the Code or any Prometheus policy are subject to disciplinary action, up to and including termination of employment and, in appropriate cases, civil action or referral for criminal prosecution.

Disciplinary action may be taken for, but not limited to, any of the following circumstances:

• Authorizing or participating in actions that violate the Code or Prometheus’ policies;

• Failing to report a violation of the Code;• Refusing to cooperate in the investigation of a potential violation;• Disclosing confidential information about an investigation;• Retaliating against an individual for reporting a potential violation;• Making a false report of misconduct or violation of the Code.

Disciplinary action will depend on the nature of the violation and the circumstances involved.

26

This section is designed to provide internal resources available to everyone for reporting and resolving compliance issues or concerns in relation to the Code of Ethical Business Conduct. When you have a question or concern about the Code, have an ethical dilemma, feel a concern you raised was not properly addressed, or would like to report a possible violation of the Code, policies or procedures – understand that there are several resources available.

:: MANAGERS ::Our managers are responsible for knowing and demonstrating compliance with both the Code of Ethical Business Conduct and compliance policies within their areas of operation. Managers are also expected to ensure that all contingent staff and consultants adhere to the Code when working for or on behalf of Prometheus. Our managers will answer questions and provide direction regarding compliance concerns. Consult with your manager for information about compliance requirements and operational policies and procedures. If you do not feel comfortable talking with your manager about a potential compliance issue, you may also contact one of the following available resources:

:: LEGAL AFFAIRS/COMPLIANCE GROUP ::The Legal Affairs Department/Compliance Group provides important interpretation of statutory and regulatory business requirements. The Legal Affairs Department/Compliance Group facilitates investigations and ensures resolution of suspected or reported violations of federal and state law, the Code of Ethical Business Conduct and Prometheus policies and procedures. The Legal Affairs Department/Compliance Group works collaboratively with management, Human Resources, and external consultants to ensure timely resolution of ethical and compliance concerns.

Prometheus provides education regarding the Code of Ethical Business Conduct and the Ethics HelpLine for all employees. In addition, some employees will receive specialized education on subjects such as state marketing and advertising laws, billing, documentation, medical necessity, employment regulations, information security and privacy that relate specifically to their job responsibilities.

:: HUMAN RESOURCES ::The Human Resources Department assists in assessing employee concerns and providing direction for the appropriate resource or remedy. Compliance concerns can include a number of related workplace issues that can be best managed through the Human Resources Department.

Resource Guide

26

This section is designed to provide internal resources available to everyone for reporting and resolving compliance issues or concerns in relation to the Code of Ethical Business Conduct. When you have a question or concern about the Code, have an ethical dilemma, feel a concern you raised was not properly addressed, or would like to report a possible violation of the Code, policies or procedures – understand that there are several resources available.

:: MANAGERS ::Our managers are responsible for knowing and demonstrating compliance with both the Code of Ethical Business Conduct and compliance policies within their areas of operation. Managers are also expected to ensure that all contingent staff and consultants adhere to the Code when working for or on behalf of Prometheus. Our managers will answer questions and provide direction regarding compliance concerns. Consult with your manager for information about compliance requirements and operational policies and procedures. If you do not feel comfortable talking with your manager about a potential compliance issue, you may also contact one of the following available resources:

:: LEGAL AFFAIRS/COMPLIANCE GROUP ::The Legal Affairs Department/Compliance Group provides important interpretation of statutory and regulatory business requirements. The Legal Affairs Department/Compliance Group facilitates investigations and ensures resolution of suspected or reported violations of federal and state law, the Code of Ethical Business Conduct and Prometheus policies and procedures. The Legal Affairs Department/Compliance Group works collaboratively with management, Human Resources, and external consultants to ensure timely resolution of ethical and compliance concerns.

Prometheus provides education regarding the Code of Ethical Business Conduct and the Ethics HelpLine for all employees. In addition, some employees will receive specialized education on subjects such as state marketing and advertising laws, billing, documentation, medical necessity, employment regulations, information security and privacy that relate specifically to their job responsibilities.

:: HUMAN RESOURCES ::The Human Resources Department assists in assessing employee concerns and providing direction for the appropriate resource or remedy. Compliance concerns can include a number of related workplace issues that can be best managed through the Human Resources Department.

Resource Guide

Business Conduct 27

We take our responsibility to act with honesty, integrity and respect very seriously, and the Code memorializes our business philosophy and our commitment to uphold its principles. Given the complexity of the regulatory landscape that governs our industry, the Code is a resource and a guide that ensures that we act in accordance with all applicable laws, regulations, and standards that govern the health care industry. It is, therefore, our responsibility to ask any questions we may have regarding the Code and to voice any concerns regarding the Code to ensure that we fully understand every aspect of the Code.

Accountability is one of our core values. Violations of the Code are not tolerated, and there are serious consequences for a violation ranging from a warning or reprimand up to and including termination of employment. In appropriate cases, civil legal action or referral for regulatory or criminal prosecution may be necessary.

We expect all employees to embrace our values and for our officers and managers to help nurture in our employees a sense of commitment to the spirit, as well as the letter, of the Code. The Code is a resource and a guide, but if at any time there are questions or concerns regarding how to act, we have numerous resources available to answer questions or share concerns. It is our responsibility to be personally vigilant with regard to any possible violations of the Code and to report any such potential violations.

We must keep in mind that action by members of our family, significant others or other persons who live in our households (referred to in the Code collectively as “family members”) may potentially result in ethical issues to the extent that they involve Prometheus business. For example, acceptance of inappropriate gifts by a family member from one of our suppliers could create a conflict of interest and result in a Code violation attributable to the Prometheus employee. Consequently, in complying with the Code, we must consider not only our own conduct, but also that of our family members.

Prometheus may revise the Code as it deems necessary in the course of its business. Employees will be advised of any changes to this Code.

Compliance with the Code of Ethical Business Conduct

“Personal leadership is

the process of keeping

your vision and values

before you and aligning

your life to be congruent

with them.”

– STEPHEN COVEY

successO U R

EQUALS

successO U R

EQUALS

BE COLLABORATIVE

BE BOLD

BE SIMPLE & FOCUSED

focus on what matters

CAN DO ATTITUDE

ACT WITH INTEGRITY

Prometheus Laboratories Inc. : : 9410 Carrol l Park Drive, San Diego, CA 92121 :: www.prometheuslabs.com

A Nestlé Health Science Company